doorkeeper 4.2.0 → 5.5.2

data/lib/doorkeeper/rake/db.rake

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+namespace :doorkeeper do
+  namespace :db do
+    desc "Removes stale data from doorkeeper related database tables"
+    task cleanup: [
+      "doorkeeper:db:cleanup:revoked_tokens",
+      "doorkeeper:db:cleanup:expired_tokens",
+      "doorkeeper:db:cleanup:revoked_grants",
+      "doorkeeper:db:cleanup:expired_grants",
+    ]
+
+    namespace :cleanup do
+      desc "Removes stale access tokens"
+      task revoked_tokens: "doorkeeper:setup" do
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper.config.access_token_model)
+        cleaner.clean_revoked
+      end
+
+      desc "Removes expired (TTL passed) access tokens"
+      task expired_tokens: "doorkeeper:setup" do
+        expirable_tokens = Doorkeeper.config.access_token_model.where(refresh_token: nil)
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(expirable_tokens)
+        cleaner.clean_expired(Doorkeeper.config.access_token_expires_in)
+      end
+
+      desc "Removes stale access grants"
+      task revoked_grants: "doorkeeper:setup" do
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper.config.access_grant_model)
+        cleaner.clean_revoked
+      end
+
+      desc "Removes expired (TTL passed) access grants"
+      task expired_grants: "doorkeeper:setup" do
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper.config.access_grant_model)
+        cleaner.clean_expired(Doorkeeper.config.authorization_code_expires_in)
+      end
+    end
+  end
+end

data/lib/doorkeeper/rake/setup.rake

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+namespace :doorkeeper do
+  task setup: :environment do
+    # Dirty hack to manually initialize AR because of lazy auto-loading,
+    # in other case we'll see NameError: uninitialized constant Doorkeeper::AccessToken
+    if Doorkeeper.config.orm == :active_record && defined?(::ActiveRecord::Base)
+      Object.const_get("::ActiveRecord::Base")
+    end
+  end
+end

data/lib/doorkeeper/rake.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Rake
+    class << self
+      def load_tasks
+        glob = File.join(File.absolute_path(__dir__), "rake", "*.rake")
+        Dir[glob].each do |rake_file|
+          load rake_file
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/request/authorization_code.rb

@@ -1,18 +1,26 @@
-require 'doorkeeper/request/strategy'
+# frozen_string_literal: true
 
 module Doorkeeper
   module Request
     class AuthorizationCode < Strategy
-      delegate :grant, :client, :parameters, to: :server
+      delegate :client, :parameters, to: :server
 
       def request
         @request ||= OAuth::AuthorizationCodeRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           grant,
           client,
-          parameters
+          parameters,
         )
       end
+
+      private
+
+      def grant
+        raise Errors::MissingRequiredParameter, :code if parameters[:code].blank?
+
+        Doorkeeper.config.access_grant_model.by_token(parameters[:code])
+      end
     end
   end
 end

data/lib/doorkeeper/request/client_credentials.rb

@@ -1,4 +1,4 @@
-require 'doorkeeper/request/strategy'
+# frozen_string_literal: true
 
 module Doorkeeper
   module Request
@@ -7,9 +7,9 @@ module Doorkeeper
 
       def request
         @request ||= OAuth::ClientCredentialsRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           client,
-          parameters
+          parameters,
         )
       end
     end

data/lib/doorkeeper/request/code.rb

@@ -1,4 +1,4 @@
-require 'doorkeeper/request/strategy'
+# frozen_string_literal: true
 
 module Doorkeeper
   module Request

data/lib/doorkeeper/request/password.rb

@@ -1,28 +1,19 @@
-require 'doorkeeper/request/strategy'
+# frozen_string_literal: true
 
 module Doorkeeper
   module Request
     class Password < Strategy
-      delegate :credentials, :resource_owner, :parameters, to: :server
+      delegate :credentials, :resource_owner, :parameters, :client, to: :server
 
       def request
         @request ||= OAuth::PasswordAccessTokenRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           client,
+          credentials,
           resource_owner,
-          parameters
+          parameters,
         )
       end
-
-      private
-
-      def client
-        if credentials
-          server.client
-        elsif parameters[:client_id]
-          server.client_via_uid
-        end
-      end
     end
   end
 end

data/lib/doorkeeper/request/refresh_token.rb

@@ -1,4 +1,4 @@
-require 'doorkeeper/request/strategy'
+# frozen_string_literal: true
 
 module Doorkeeper
   module Request
@@ -6,14 +6,15 @@ module Doorkeeper
       delegate :credentials, :parameters, to: :server
 
       def refresh_token
-        server.current_refresh_token
+        Doorkeeper.config.access_token_model.by_refresh_token(parameters[:refresh_token])
       end
 
       def request
         @request ||= OAuth::RefreshTokenRequest.new(
-          Doorkeeper.configuration,
-          refresh_token, credentials,
-          parameters
+          Doorkeeper.config,
+          refresh_token,
+          credentials,
+          parameters,
         )
       end
     end

data/lib/doorkeeper/request/strategy.rb

@@ -1,12 +1,14 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Strategy
-      attr_accessor :server
+      attr_reader :server
 
       delegate :authorize, to: :request
 
       def initialize(server)
-        self.server = server
+        @server = server
       end
 
       def request

data/lib/doorkeeper/request/token.rb

@@ -1,4 +1,4 @@
-require 'doorkeeper/request/strategy'
+# frozen_string_literal: true
 
 module Doorkeeper
   module Request

data/lib/doorkeeper/request.rb

@@ -1,40 +1,73 @@
-require 'doorkeeper/request/authorization_code'
-require 'doorkeeper/request/client_credentials'
-require 'doorkeeper/request/code'
-require 'doorkeeper/request/password'
-require 'doorkeeper/request/refresh_token'
-require 'doorkeeper/request/token'
+# frozen_string_literal: true
 
 module Doorkeeper
   module Request
-    module_function
+    class << self
+      def authorization_strategy(response_type)
+        grant_flow = authorization_flows.detect do |flow|
+          flow.matches_response_type?(response_type)
+        end
 
-    def authorization_strategy(response_type)
-      get_strategy response_type, authorization_response_types
-    rescue NameError
-      raise Errors::InvalidAuthorizationStrategy
-    end
+        if grant_flow
+          grant_flow.response_type_strategy
+        else
+          # [NOTE]: this will be removed in a newer versions of Doorkeeper.
+          # For retro-compatibility only
+          build_fallback_strategy_class(response_type)
+        end
+      end
 
-    def token_strategy(grant_type)
-      get_strategy grant_type, token_grant_types
-    rescue NameError
-      raise Errors::InvalidTokenStrategy
-    end
+      def token_strategy(grant_type)
+        raise Errors::MissingRequiredParameter, :grant_type if grant_type.blank?
 
-    def get_strategy(grant_or_request_type, available)
-      fail Errors::MissingRequestStrategy unless grant_or_request_type.present?
-      fail NameError unless available.include?(grant_or_request_type.to_s)
-      "Doorkeeper::Request::#{grant_or_request_type.to_s.camelize}".constantize
-    end
+        grant_flow = token_flows.detect do |flow|
+          flow.matches_grant_type?(grant_type)
+        end
 
-    def authorization_response_types
-      Doorkeeper.configuration.authorization_response_types
-    end
-    private_class_method :authorization_response_types
+        if grant_flow
+          grant_flow.grant_type_strategy
+        else
+          # [NOTE]: this will be removed in a newer versions of Doorkeeper.
+          # For retro-compatibility only
+          raise Errors::InvalidTokenStrategy unless available.include?(grant_type.to_s)
+
+          strategy_class = build_fallback_strategy_class(grant_type)
+          raise Errors::InvalidTokenStrategy unless strategy_class
+
+          strategy_class
+        end
+      end
+
+      private
+
+      def authorization_flows
+        Doorkeeper.configuration.authorization_response_flows
+      end
+
+      def token_flows
+        Doorkeeper.configuration.token_grant_flows
+      end
+
+      # [NOTE]: this will be removed in a newer versions of Doorkeeper.
+      # For retro-compatibility only
+      def available
+        Doorkeeper.config.deprecated_token_grant_types_resolver
+      end
+
+      def build_fallback_strategy_class(grant_or_request_type)
+        strategy_class_name = grant_or_request_type.to_s.tr(" ", "_").camelize
+        fallback_strategy = "Doorkeeper::Request::#{strategy_class_name}".constantize
+
+        ::Kernel.warn <<~WARNING
+          [DOORKEEPER] #{fallback_strategy} found using fallback, it must be
+          registered using `Doorkeeper::GrantFlow.register(grant_flow_name, **options)`.
+          This functionality will be removed in a newer versions of Doorkeeper.
+        WARNING
 
-    def token_grant_types
-      Doorkeeper.configuration.token_grant_types
+        fallback_strategy
+      rescue NameError
+        raise Errors::InvalidTokenStrategy
+      end
     end
-    private_class_method :token_grant_types
   end
 end

data/lib/doorkeeper/secret_storing/base.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Base class for secret storing, including common helpers
+    class Base
+      ##
+      # Return the value to be stored by the database
+      # used for looking up a database value.
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(_plain_secret)
+        raise NotImplementedError
+      end
+
+      ##
+      # Transform and store the given secret attribute => value
+      # pair used for safely storing the attribute
+      # @param resource The model instance being modified
+      # @param attribute The secret attribute
+      # @param plain_secret The plain secret input / generated
+      def self.store_secret(resource, attribute, plain_secret)
+        transformed_value = transform_secret(plain_secret)
+        resource.public_send(:"#{attribute}=", transformed_value)
+
+        transformed_value
+      end
+
+      ##
+      # Return the restored value from the database
+      # @param resource The resource instance to act on
+      # @param attribute The secret attribute to restore
+      # as retrieved from the database.
+      def self.restore_secret(_resource, _attribute)
+        raise NotImplementedError
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+
+      ##
+      # Determines what secrets this strategy is applicable for
+      def self.validate_for(model)
+        valid = %i[token application]
+        return true if valid.include?(model.to_sym)
+
+        raise ArgumentError, "'#{name}' can not be used for #{model}."
+      end
+
+      ##
+      # Securely compare the given +input+ value with a +stored+ value
+      # processed by +transform_secret+.
+      def self.secret_matches?(input, stored)
+        transformed_input = transform_secret(input)
+        ActiveSupport::SecurityUtils.secure_compare transformed_input, stored
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/bcrypt.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class BCrypt < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        ::BCrypt::Password.create(plain_secret.to_s)
+      end
+
+      ##
+      # Securely compare the given +input+ value with a +stored+ value
+      # processed by +transform_secret+.
+      def self.secret_matches?(input, stored)
+        ::BCrypt::Password.new(stored.to_s) == input.to_s
+      rescue ::BCrypt::Errors::InvalidHash
+        false
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+
+      ##
+      # Determines what secrets this strategy is applicable for
+      def self.validate_for(model)
+        unless model.to_sym == :application
+          raise ArgumentError,
+                "'#{name}' can only be used for storing application secrets."
+        end
+
+        unless bcrypt_present?
+          raise ArgumentError,
+                "'#{name}' requires the 'bcrypt' gem being loaded."
+        end
+
+        true
+      end
+
+      ##
+      # Test if we can require the BCrypt gem
+      def self.bcrypt_present?
+        require "bcrypt"
+        true
+      rescue LoadError
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/plain.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class Plain < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        plain_secret
+      end
+
+      ##
+      # Return the restored value from the database
+      # @param resource The resource instance to act on
+      # @param attribute The secret attribute to restore
+      # as retrieved from the database.
+      def self.restore_secret(resource, attribute)
+        resource.public_send(attribute)
+      end
+
+      ##
+      # Plain values obviously allow restoring
+      def self.allows_restoring_secrets?
+        true
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/sha256_hash.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class Sha256Hash < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        ::Digest::SHA256.hexdigest plain_secret
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/server.rb

@@ -1,19 +1,21 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class Server
-    attr_accessor :context
+    attr_reader :context
 
-    def initialize(context = nil)
+    def initialize(context)
       @context = context
     end
 
     def authorization_request(strategy)
-      klass = Request.authorization_strategy strategy
-      klass.new self
+      klass = Request.authorization_strategy(strategy)
+      klass.new(self)
     end
 
     def token_request(strategy)
-      klass = Request.token_strategy strategy
-      klass.new self
+      klass = Request.token_strategy(strategy)
+      klass.new(self)
     end
 
     # TODO: context should be the request
@@ -25,29 +27,17 @@ module Doorkeeper
       @client ||= OAuth::Client.authenticate(credentials)
     end
 
-    def client_via_uid
-      @client_via_uid ||= OAuth::Client.find(parameters[:client_id])
-    end
-
     def current_resource_owner
       context.send :current_resource_owner
     end
 
-    def current_refresh_token
-      AccessToken.by_refresh_token(parameters[:refresh_token])
-    end
-
-    def grant
-      AccessGrant.by_token(parameters[:code])
-    end
-
     # TODO: Use configuration and evaluate proper context on block
     def resource_owner
       context.send :resource_owner_from_credentials
     end
 
     def credentials
-      methods = Doorkeeper.configuration.client_credentials_methods
+      methods = Doorkeeper.config.client_credentials_methods
       @credentials ||= OAuth::Client::Credentials.from_request(context.request, *methods)
     end
   end

data/lib/doorkeeper/stale_records_cleaner.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  class StaleRecordsCleaner
+    CLEANER_CLASS = "StaleRecordsCleaner"
+
+    def self.for(base_scope)
+      orm_adapter = "doorkeeper/orm/#{configured_orm}".classify
+
+      orm_cleaner = "#{orm_adapter}::#{CLEANER_CLASS}".constantize
+      orm_cleaner.new(base_scope)
+    rescue NameError
+      raise Doorkeeper::Errors::NoOrmCleaner, "'#{configured_orm}' ORM has no cleaner!"
+    end
+
+    def self.new(base_scope)
+      self.for(base_scope)
+    end
+
+    def self.configured_orm
+      Doorkeeper.config.orm
+    end
+  end
+end

data/lib/doorkeeper/validations.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Validations
     extend ActiveSupport::Concern
@@ -6,9 +8,10 @@ module Doorkeeper
 
     def validate
       @error = nil
+
       self.class.validations.each do |validation|
+        @error = validation[:options][:error] unless send("validate_#{validation[:attribute]}")
         break if @error
-        @error = validation.last unless send("validate_#{validation.first}")
       end
     end
 
@@ -19,7 +22,7 @@ module Doorkeeper
 
     module ClassMethods
       def validate(attribute, options = {})
-        validations << [attribute, options[:error]]
+        validations << { attribute: attribute, options: options }
       end
 
       def validations

data/lib/doorkeeper/version.rb

@@ -1,3 +1,14 @@
+# frozen_string_literal: true
+
 module Doorkeeper
-  VERSION = "4.2.0".freeze
+  module VERSION
+    # Semantic versioning
+    MAJOR = 5
+    MINOR = 5
+    TINY = 2
+    PRE = nil
+
+    # Full version number
+    STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
+  end
 end